CVE-2026-72107 dm era: fix out-of-bounds memory access for non-zero start sector
A local attacker with access to a dm-era device with a non-zero start sector can trigger an out-of-bounds memory access, potentially causing a crash or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72107?
CVE-2026-72107 is a high-severity memory corruption vulnerability in Linux, published on 15 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dm era: fix out-of-bounds memory access for non-zero start sector
dm-era tracks writes in target-relative blocks, but era_map() calculates the writeset block before applying the target offset. Tables with a non-zero start sector can therefore pass an absolute mapped-device block to metadata_current_marked().
If the absolute block is beyond the current writeset size, writeset_marked() tests past the end of the in-core bitset. KASAN reports this as a vmalloc-out-of-bounds access.
Apply the target offset before calculating the era block so writeset lookups use the target-relative block number.
Weakness: CWE-125
Which versions are affected by CVE-2026-72107?
How do I fix CVE-2026-72107?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72107 being exploited?
There is no known exploitation of CVE-2026-72107 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72107, DEBIAN-CVE-2026-72107, GHSA-pp8j-c3wv-r68r, UBUNTU-CVE-2026-72107.